Archive
8 December 2025
Vulnerabilities first published on this day (UTC), newest first.
77 results · Clear filters · Feed
-
Medium 6.3
code-projects Simple Shopping Cart settings.php sql injection
A vulnerability was found in code-projects Simple Shopping Cart 1.0. This vulnerability affects unknown code of the file /Customers/settings.php. Performing manipulation of the argument user_id results in sql injection. Remote exploitation of the attack is po…
-
Medium 6.3
code-projects Daily Time Recording System add_payroll.php sql injection
A vulnerability was detected in code-projects Daily Time Recording System 4.5.0. The impacted element is an unknown function of the file /admin/add_payroll.php. Performing manipulation of the argument detail_Id results in sql injection. The attack can be init…
-
Medium 4.7
SourceCodester Inventory Management System SVC Report Export csv injection
A security vulnerability has been detected in SourceCodester Inventory Management System 1.0. The affected element is an unknown function of the component SVC Report Export. Such manipulation leads to csv injection. It is possible to launch the attack remotel…
-
Medium 6.3
Philipinho Simple-PHP-Blog edit.php sql injection
A security flaw has been discovered in Philipinho Simple-PHP-Blog up to 94b5d3e57308bce5dfbc44c3edafa9811893d958. This issue affects some unknown processing of the file /edit.php. The manipulation results in sql injection. The attack may be performed from rem…
-
Medium 5.3
Jobs can be saved as workflows with wrong permissions on KNIME Business Hub
A wrong permission check in KNIME Business Hub before version 1.17.0 allowed an authenticated user to save jobs of other users as if there were saved by the job owner. The attacker must have permissions to access the jobs but then they were saved into the cat…
-
Medium 6.7
FULLBACK Manager Pro provided by GS Yuasa International Ltd. registers two Windows services with unquoted file paths. A…
-
Medium 6.3
D-Link DCS-930L alphapd setSystemAdmin command injection
A vulnerability was determined in D-Link DCS-930L 1.15.04. This affects an unknown part of the file /setSystemAdmin of the component alphapd. Executing manipulation of the argument AdminID can lead to command injection. The attack can be executed remotely. Th…
-
Medium 6.5
Improper input validation in Netconf service in Infinera MTC-9
Improper input validation in the Netconf service in Infinera MTC-9 allows remote authenticated users to crash the service and reboot the appliance, thus causing a DoS condition, via crafted XML payloads.This issue affects MTC-9: from R22.1.1.0275 before R23.0.
-
Medium 4.9
App lock verification bypass vulnerability in the file management app. Impact: Successful exploitation of this vulnerab…
-
Medium 4.0
Permission control vulnerability in the window management module. Impact: Successful exploitation of this vulnerability…
-
Medium 4.3
Yottamaster DM2/DM3/DM200 File Upload path traversal
A vulnerability was found in Yottamaster DM2, DM3 and DM200 up to 1.2.23/1.9.12. Affected by this issue is some unknown functionality of the component File Upload. Performing manipulation results in path traversal. Remote exploitation of the attack is possibl…
-
Medium 6.2
Permission control vulnerability in the package management module. Impact: Successful exploitation of this vulnerabilit…
-
Medium 4.4
Permission control vulnerability in the media library module. Impact: Successful exploitation of this vulnerability may…
-
Medium 6.7
Race condition vulnerability in the audio module. Impact: Successful exploitation of this vulnerability may affect avai…
-
Medium 5.3
Vulnerability of improper criterion security check in the card module. Impact: Successful exploitation of this vulnerab…
-
Medium 5.1
Multi-thread race condition vulnerability in the camera framework module. Impact: Successful exploitation of this vulne…
-
Medium 5.1
Multi-thread race condition vulnerability in the camera framework module. Impact: Successful exploitation of this vulne…
-
Medium 5.1
Multi-thread race condition vulnerability in the camera framework module. Impact: Successful exploitation of this vulne…
-
Medium 6.5
Galaxy Software Services｜Vitals ESP - SQL Injection
Vitals ESP developed by Galaxy Software Services has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents.
-
Medium 6.5
Galaxy Software Services｜Vitals ESP - SQL Injection
Vitals ESP developed by Galaxy Software Services has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents.
-
Medium 4.9
Galaxy Software Services｜Vitals ESP - Arbitrary File Read
Vitals ESP developed by Galaxy Software Services has an Arbitrary File Read vulnerability, allowing privileged remote attackers to exploit Absolute Path Traversal to download arbitrary system files.
-
Medium 6.3
code-projects Employee Profile Management System print_personnel_report.php sql injection
A flaw has been found in code-projects Employee Profile Management System 1.0. Affected is an unknown function of the file /print_personnel_report.php. This manipulation of the argument per_id causes sql injection. The attack may be initiated remotely. The ex…
-
Medium 4.3
ORICO CD3510 File Upload path traversal
A security vulnerability has been detected in ORICO CD3510 1.9.12. This affects an unknown function of the component File Upload. The manipulation leads to path traversal. The attack can be initiated remotely. The exploit has been disclosed publicly and may b…
-
Medium 4.7
Campcodes Retro Basketball Shoes Online Store admin_running.php unrestricted upload
A weakness has been identified in Campcodes Retro Basketball Shoes Online Store 1.0. The impacted element is an unknown function of the file /admin/admin_running.php. Executing a manipulation of the argument product_image can lead to unrestricted upload. It i…
-
Medium 6.3
itsourcecode Student Information System section_edit1.php sql injection
A vulnerability has been found in itsourcecode Student Information System 1.0. This affects an unknown part of the file /section_edit1.php. The manipulation of the argument ID leads to sql injection. Remote exploitation of the attack is possible. The exploit …
-
Medium 6.3
D-Link DIR-823X set_wan_settings sub_415028 command injection
A security flaw has been discovered in D-Link DIR-823X up to 20250416. This affects the function sub_415028 of the file /goform/set_wan_settings. The manipulation of the argument ppp_username results in command injection. It is possible to launch the attack r…
-
Medium 6.5
SourceCodester Online Student Clearance System Fee Table delete-fee.php improper authorization
A vulnerability was determined in SourceCodester Online Student Clearance System 1.0. The affected element is an unknown function of the file /Admin/delete-fee.php of the component Fee Table Handler. Executing manipulation of the argument ID can lead to impro…
-
Medium 6.5
A memory disclosure vulnerability exists in libcoap's OSCORE configuration parser in libcoap before release-4.3.5-patch…
-
Medium 5.3
Emlog Pro 2.5.20 has an arbitrary file deletion vulnerability. This vulnerability stems from the admin/template.php com…
-
Medium 6.5
Tenda AX3 v16.03.12.11 contains a stack overflow in formSetIptv via the iptvType parameter, which can cause memory corr…
-
Medium 4.3
memos lacks file name validation or verification
A lack of file name validation or verification in the Attachment service of usememos memos v0.25.2 allows attackers to execute a path traversal.
-
Medium 6.1
Barix Instreamer v04.06 and earlier is vulnerable to Cross Site Scripting (XSS) in the Web UI I/O & Serial configuratio…
-
Medium 6.5
memos vulnerability allows arbitrarily modification or deletion registered identity providers
Incorrect access control in the Identity Provider service of usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily modify or delete registered identity providers, leading to an account takeover or Denial of Service (DoS).
-
Medium 5.4
memos vulnerability allows arbitrarily modification or deletion of attachments
Incorrect access control in usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily modify or delete attachments made by other users.
-
Medium 4.6
A stored cross-site scripting (XSS) vulnerability exists in the web interface of Lyrion Music Server <= 9.0.3. An authe…
-
Medium 5.4
Barix Instreamer v04.06 and v04.05 contains a stored cross-site scripting (XSS) vulnerability in the Web UI Configurati…
-
Medium 4.3
memos vulnerability allows arbitrarily reactions deletion
Incorrect access control in usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily delete reactions made to other users' Memos.